I am trying to force encryption when transferring a file to a removable storage, but I could not figure how.
The scenario is that a user plugs in a USB memory stick which may already contain some files. The user tries to copy a file from the local filesystem to the memory stick. The file is encrypted on the fly transparently and the copied file on the memory stick is now encrypted. This should not be optional but mandatory. The user without root privilege should not be able to bypass this, and transfer unencrypted files to the memory stick.
What I am looking for is I think "Stacked filesystem encryption" not a block device encryption as I do not want to encrypt a whole drive but only the files written to it (also I do not want to encrypt the files already present on the memory stick).
The closest I could get to the solution was
encfs, but it does not force encryption to the whole memory stick, but rather creates an encrypted folder on the memory stick and encrypts only if the files are copied to that folder. I tried mounting the root folder of the usb disk but that got messy as it was already mounted by the filesystem.
Probably I should implement this as a kernel module but I wonder if there is an existing solution for my problem or a workaround?